CVE-2024-9252: Foxit PDF Editor Use-After-Free Vulnerability

CVE-2024-9252 Overview

CVE-2024-9252 is a use-after-free vulnerability in Foxit PDF Reader and Foxit PDF Editor on Windows. The flaw resides in the handling of AcroForms and can be exploited to disclose sensitive information from the current process. Remote attackers must convince a user to open a crafted PDF or visit a malicious page hosting one. The vulnerability is tracked under CWE-416 and was reported through the Zero Day Initiative as ZDI-CAN-24491. Attackers can chain this issue with additional flaws to achieve arbitrary code execution in the context of the current user.

Critical Impact
Successful exploitation allows attackers to leak process memory and, when chained with other vulnerabilities, execute arbitrary code as the logged-in user.

Affected Products

Foxit PDF Reader (Windows)
Foxit PDF Editor (Windows)
Legacy Foxit PhantomPDF branded builds on Windows

Discovery Timeline

2024-11-22 - CVE-2024-9252 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9252

Vulnerability Analysis

The flaw is a use-after-free condition triggered while Foxit PDF Reader processes AcroForm objects. AcroForms are the interactive form technology embedded in PDF documents, permitting scripted behavior through form fields and JavaScript actions. The reader performs operations on an AcroForm object without validating that the object still exists in memory. An attacker who controls the freed allocation can influence the data returned when the dangling pointer is dereferenced.

Exploitation requires user interaction. The target must open a malicious PDF or visit a page that loads one through the Foxit browser plugin. Once triggered, the primitive discloses memory contents belonging to the reader process. This information can defeat Address Space Layout Randomization (ASLR) and stage a follow-on write primitive for arbitrary code execution.

Root Cause

The root cause is missing object lifetime validation within the AcroForm handler. Code paths perform read or method-dispatch operations on an object reference after the underlying allocation has been released. The condition maps to CWE-416: Use After Free and typically follows a JavaScript-driven manipulation of form fields that frees the object while a reference is retained on the call path.

Attack Vector

The attack vector is local, requiring a user to open a weaponized PDF document. Delivery channels include email attachments, drive-by downloads, watering hole sites, and internal file shares. Because Foxit PDF Reader also registers a browser plugin, visiting a page that embeds a malicious PDF is sufficient to trigger the vulnerable code path.

Refer to the Zero Day Initiative Advisory ZDI-24-1304 for further technical context. No public proof-of-concept exploit is available at the time of writing.

Detection Methods for CVE-2024-9252

Indicators of Compromise

Unexpected FoxitPDFReader.exe or FoxitPDFEditor.exe process crashes with access violation exceptions referencing AcroForm modules.
PDF files containing heavily obfuscated JavaScript that manipulates AcroForm field objects and forces reallocation loops.
Child processes spawned from Foxit reader executables, such as cmd.exe, powershell.exe, or rundll32.exe.

Detection Strategies

Hunt for Foxit reader processes performing outbound network connections shortly after opening a document from an email or browser download.
Inspect PDFs at the mail gateway for embedded JavaScript that repeatedly creates, deletes, and references AcroForm fields.
Correlate Windows Error Reporting WER entries citing Foxit binaries with the same user opening PDFs from untrusted sources.

Monitoring Recommendations

Enable EDR telemetry for image loads and child-process creation under FoxitPDFReader.exe and FoxitPDFEditor.exe.
Log PDF attachment metadata at the email gateway, including embedded JavaScript indicators and AcroForm object counts.
Monitor Foxit application version telemetry across the estate to identify unpatched installations.

How to Mitigate CVE-2024-9252

Immediate Actions Required

Update Foxit PDF Reader and Foxit PDF Editor on Windows to the fixed versions listed in the Foxit Security Bulletins.
Disable the Foxit browser plugin until patching is complete to remove the drive-by delivery path.
Restrict opening of PDFs received from external senders through email gateway policy and user awareness reminders.

Patch Information

Foxit has released fixed builds addressing CVE-2024-9252. Review the Foxit Security Bulletins and the Zero Day Initiative Advisory ZDI-24-1304 for the specific patched version numbers applicable to your deployment. Deploy updates through your standard software distribution mechanism and validate the installed version on all endpoints.

Workarounds

Disable JavaScript execution in Foxit PDF Reader via Preferences > JavaScript > Enable JavaScript Actions until the patch is applied.
Enable Safe Reading Mode in Foxit to restrict access to external resources and script actions.
Use Windows Attack Surface Reduction rules to block Office and mail clients from launching Foxit as a child process for untrusted content.

bash

# Configuration example: disable Foxit AcroForm JavaScript via registry (Windows)
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\JavaScript" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Foxit Software\Foxit PDF Reader\Preferences\Trust Manager" /v bSafeMode /t REG_DWORD /d 1 /f